CVE-2026-42324
Deferred Deferred - Pending Action

SQL Injection in Piwigo Photo Gallery

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-42324
EUVD
EUVD-2026-87138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
piwigo piwigo to 16.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Piwigo versions before 16.4.0 have a flaw in admin/element_set_ranks.php where administrator-controlled image_order[] values are stored without checking against a sort-field whitelist. This stored value can later be used in ORDER BY clauses in multiple admin files, allowing an authenticated admin to inject crafted expressions. When exploited, this can lead to unauthorized data disclosure, modification, or disruption in the database.

Detection Guidance

Check Piwigo version for installations below 16.4.0. Review admin/element_set_ranks.php and related files for unauthorized image_order[] modifications. Monitor database queries for unexpected ORDER BY clauses in admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php.

Impact Analysis

If you are an administrator using Piwigo before version 16.4.0, an attacker with admin access could exploit this to read, change, or delete sensitive data in your database. This includes photos, user information, or other gallery content. The impact depends on the data stored in your Piwigo instance.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of personal data, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using Piwigo must ensure they are running patched versions to maintain compliance and protect sensitive data.

Mitigation Strategies

Upgrade Piwigo to version 16.4.0 or later immediately. Restrict administrator access to trusted users only. Review and audit database query logs for suspicious activity. Apply database-level restrictions to prevent unauthorized ORDER BY clause modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart